CVE-2026-61595: djust: Multi-tenant isolation fails open on the WebSocket/SSE path, disclosing other tenants' data

Published Sep 16, 2026
·
Updated

Impact djust.tenants isolation was enforced only on the HTTP path. The current tenant was stored in threading.local() and set exclusively by the HTTP-only TenantMiddleware, so on the live (WebSocket/SSE) path getcurrenttenant() was always None during mount and every event handler — and the tenant-aware QuerySet manager failed OPEN (returned the unfiltered queryset, ignoring STRICTMODE), disclosing every tenant's rows to whoever held the socket. threading.local was additionally shared across connections on the synctoasync executor thread.

Patches Fixed in djust 1.0.7. Tenant storage moved to a contextvars.ContextVar (per async task); the resolved tenant is bound around WS/SSE mount and every dispatch; both managers scope the base queryset once and fail CLOSED (.none() under the default STRICTMODE); and system check S006 warns when STRICTMODE=False.

Workarounds No workaround on the live path short of upgrading.

Other sources

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust.tenants isolation was enforced only on the HTTP path. The current tenant was stored in threading.local() and set exclusively by the HTTP-only TenantMiddleware, so on the live (WebSocket/SSE) path getcurrenttenant() was always None during mount and every event handler — and the tenant-aware QuerySet manager failed OPEN (returned the unfiltered queryset, ignoring STRICTMODE), disclosing every tenant's rows to whoever held the socket. threading.local was additionally shared across connections on the synctoasync executor thread. This issue is fixed in djust 1.0.7. Tenant storage moved to a contextvars.ContextVar (per async task); the resolved tenant is bound around WS/SSE mount and every dispatch; both managers scope the base queryset once and fail CLOSED (.none() under the default STRICTMODE); and system check S006 warns when STRICTMODE=False. No known workarounds are available on the live path.

MITRE

Affected Software

2 affected componentsFixes available
djust djust<1.0.7
pip/djust<1.0.7
1.0.7

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade pip/djust to a version that resolves this vulnerability.

    Fixed in 1.0.7
  2. Upgrade

    Upgrade djust to a version that resolves this vulnerability.

    Fixed in 1.0.7

Event History

Sep 16, 2026
Advisory Published
via GitHub·03:32 PM
Data Sourced
via GitHub·03:32 PM
DescriptionSeverityWeaknessAffected Software
CVE Published
via MITRE·03:33 PM
Data Sourced
via MITRE·03:33 PM
DescriptionSeverityWeakness

Frequently Asked Questions

1

Who is exposed to this issue?

Deployments using djust.tenants with live WebSocket or SSE functionality are exposed if they run a version prior to 1.0.7. Any user who can hold a live socket may receive rows belonging to other tenants.

2

What does an attacker need to exploit it?

An attacker needs a low-privileged account and access to an affected WebSocket or SSE live path. No user interaction is required, and the vulnerable tenant-aware queryset behavior can return unfiltered data during mount and event handling.

3

Does the default strict-mode configuration prevent exposure?

No. On affected versions, the live-path queryset manager failed open and ignored STRICT_MODE because no current tenant was bound on the WebSocket/SSE path.

4

What should be done if patching is not immediately possible?

No known workaround is available for the live path. Upgrade to djust 1.0.7; until then, avoid exposing affected WebSocket or SSE tenant-facing functionality.

5

How can I determine whether my deployment is affected?

Check whether djust.tenants is used with WebSocket or SSE live features and whether the installed djust version is earlier than 1.0.7. Affected versions have tenant context set only through the HTTP-only TenantMiddleware, leaving the live path without a current tenant.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203